Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The email from Agent@Adobe.com claims to be from Adobe. After analyzing its source i have not found anything suspicious, only ivest8 and this IP: 98.143.35.69.

While invest8 shows a lot in Google, i have analyzed IP:

enter image description here

When i followed link, i have arrived to a page trying me to peddle something so it was obvious email was not real.

It also is weird that after i saved email as .HTML file and executed it, i was brought to site without being able to view email. Looks like a tricky redirect in source code to me...

If anybody here knows how to find forged and spoofy emails, can you enlighten me please? Here is the link to download .EML file.

Thanks.

share|improve this question

closed as off topic by soandos, techie007, Mokubai, ChrisF, studiohack Jan 25 '12 at 20:30

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

1 Answer

up vote 9 down vote accepted
  • The sender address does not belong to Adobe. According to WHOIS, it is owned by "CWIE, LLC".

    Received: from invest8 ([98.143.35.69]) by mxin7.netvision.net.il
    
  • Spelling and grammar errors in the subject. PDF mistyped as "Pdf".

    Subject: Convert Any File to Pdf and FREE OFFICE SUIT INCLUDED !
    
  • Adobe is very unlikely to use Microsoft Outlook Express for anything, and especially not for batch emails.

    X-Mailer: Microsoft Outlook Express 6.00.2800.1106
    
  • "Microsoft MimeOLE" is a quite reliable sign of spam messages.

    X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
    
  • The links in the message body point to toptraces.com, which hosts a public URL shortener service.

  • The website http://pdf-pro-online.com/, pointed to by http://toptraces.com/pdf2012, is not affiliated with Adobe, as it says in the footer:

    This website has no affiliation whatsoever with the owner of the software program Adobe and does not re-sell or license the Adobe software. This website offers an alternative to the Adobe PDF Reader/Wrtier software. Membership is for unlimited access to our site's resources. We also provide technical support, tutorials and step by step guides.

    The website is owned and operated by Certo Business Solutions B.V

Conclusion: Spam.

share|improve this answer
1  
That's a good analysis and this email is just another competitor peddling alternative to Adobe software. At least no threat of harm as it seems. –  Boris_yo Jan 22 '12 at 20:14
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.